Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - March 17, 2017

A Model Proposal for Organizational Prudence and Wisdom Within Governance of Business and Enterprise IT

An organization’s ability to respond to changing environments is a critical issue. Decision-making bodies at all levels need to adjust to meet fast-changing environments. Basically, an organization needs to change its information systems to fit the new requirements. In turn, appropriate computer techniques and technologies can be applied that best meet the requirements for the changed business conditions and stakeholder needs. The current failures of organizations indicate that their information systems are not reflective of current business conditions and ecosystems, even though the application of newer techniques and technologies may abound in the organization. The turbulence of current business conditions, then, necessitates the need for decision makers to use the latest in information system developments—that is, optimal knowledge management (KM)/wisdom management (WM) systems.

Intel pursuing new chips as it plots a wearables future

The company's approach to wearables is being replicated in other areas like the Intel Sports Group, which is developing technology so users can watch 3D sports broadcasts as if they were in the stadium. One way to achieve that is by putting more cameras across the field, including helmets worn by players. Using algorithms, Intel servers slice and dice the images from the cameras to provide the customized footage. This will translate well to wearables like VR headsets, as users will be able to get a bird's eye view of a touchdown in a football game or a goal in soccer. Chips like Curie are already instrumental in improving the sports viewing experience from events like last year's Winter X Games. In real time, viewers were able to view key athlete performance data like the height of a snowboarder jump and how far they rotated.

How A.I. technology is causing major ripples in the travel industry

“Flight fares and hotel prices are ever-changing and vary greatly depending on the provider,” software company AltexSoft admits. “No one has time to track all those changes manually. Thus, smart tools which monitor and send out timely alerts with hot deals are currently in high demand in the travel industry.” Dynamic pricing and fare forecasting tools are all the rage right now. People know there are better deals out there and want access to information that helps them save as much money as possible on flights, hotels, and other accommodations. Hopper is one of the leading startups in this area. They’ve raised more than $37 million to date and have built an advanced application that uses applied predictive analytics to tell users exactly when to pull the trigger on a travel deal.

Augmented and virtual reality to see aggressive growth by 2021

IDC includes in its count of commercial VR and AR the numerous arcades in China's cities where customers play online VR games. "A lot of VR gaming is taking place that way," he said. Those headsets are purchased by the arcade or movie theater operators, and are counted as commercial sales, he explained. Even with those kinds of early successes, VR still suffers from limited content. "There's not a lot of VR content out there and what is out there is very targeted" to younger users and gamers, Ubrani said. Facebook, which purchased Oculus in 2014, allows users to create VR avatars to use in a virtual world, for example. Strategy Analytics on Thursday said VR is "poised for tremendous growth over the next several years," but tempered its optimism with a survey that indicates VR experiences are still wanting.

Why Google's smart jacket could be a boon for commuters

Google and Levi's first announced plans to create the interactive jacket last year. It will mark the first widely available product using technology from Google's Project Jacquard, announced in 2015, which aims to make it possible to "weave touch and gesture interactivity into any textile using standard, industrial looms," according to the project's website. Basically, Google has made conductive yarn, which will allow the company to create smart clothes and smart furniture by adding in interactive surfaces to the fabric. "Project Jacquard will allow designers and developers to build connected, touch-sensitive textiles into their own products," the website stated. The Levi's Commuter Trucker Jacket was designed specifically for urban bike commuters. The jacket is dark denim, very similar in terms of looks to other Levi's commuter coats.

Online cybersecurity course targets business professionals

Because new technologies will require new policies and incentives, and emerging policies must adapt to future technologies, "We have brought together a pool of world-renowned faculty cybersecurity experts from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) and the Sloan School of Management to teach this online course," Shrobe said. The six-week course offers a holistic, comprehensive view of key technologies, techniques and systems. The goal, said Shrobe, is for participants to walk away with a broad understanding of hardware, software, cryptography, and policy to make better, safer long-term security decisions. "Some of the research we focus on is about creating systems that are harder to hack. We’ve demonstrated that it is possible to design a modern computer system that attackers can’t break into and that can protect our information," Shrobe said.

3 Important New Cyber Security Trends

If 2016 was the year of cyber attacks, 2017 is the year of prevention. Twelve months ago, experts were predicting an increase in the innovation and sophistication of cyber attacks and a greater breakdown in security measures on a global scale. With the Internet of Things (IoT) making the world more connected than ever and companies continuing to back-burner security issues, forecasters pointed to a perfect storm. Organizations and individuals would be more vulnerable than ever. They were right. But from the wreckage of hacks and privacy violations of 2016, some important lessons were learned and they will set the trend for the next wave of technology innovations. Managing Director of the Information Security Forum (ISF) Steve Durbin, a risk management expert, said, “I think we are seeing a raised level awareness about the fact that operating in cyber brings about its own peculiarities…I see an increasing maturity and development of the cyber crime gangs.

Standards and Security: The Great DDoS Challenge

DDoS attacks are becoming far more sophisticated so it’s essential that hardware and software manufacturers start to seriously consider standards to address the potential security risks in the growing Internet of Things. One key standard is the Open Trusted Technology Provider Standard, or O-TTPS, which addresses these issues around supply chain security and product integrity. Recently approved as ISO/IEC 20243, this set of best practices can be applied from design to disposal, throughout the supply chain and the entire product life cycle. Standards like the O-TTPS aim to reduce the risk of tainted (e.g., malware-enabled and malware-capable) and counterfeit hardware and software components from entering the supply chains and making their way into products that connect to the internet. This specific standard also has a conformance program that identifies Open Trusted Technology Providers who conform.

Cybersecurity not a one-time effort for small businesses; requires constant vigilance

Invasions that render a computer’s files unusable unless the user pays a ransom have also surged. Cybercriminals who use this method are aggressive — one variation of ransomware attacked an estimated 100,000 computers a day within weeks of its release last year, according to the FBI. The costs of an invasion can be steep. Heath estimates he lost $10,000 in business because the site was down. He didn’t have to pay to have the website rebuilt, because his business was part of an incubator where tech help was available for free. But recreating a website could run a business well into the thousands of dollars. Many owners believe they don’t have the resources — human or financial — to keep their companies safe, which takes keeping up with frequent security updates for software and equipment.

India ID plan wins World Bank praise amid Big Brother fears

An ambitious government-run project -- just like the Internet at the time of its creation decades ago -- Aadhaar began in 2009 to target payments to the poor across India’s vast hinterland. Other governments are already interested in its potential. Countries such as Tanzania, Afghanistan and Bangladesh have visited India to talk about the system, said Nandan Nilekani, billionaire co-founder of the technology company Infosys Ltd. and former chairman of the Unique Identification Authority of India, who created Aadhaar. Russia, Morocco, Algeria and Tunisia have also indicated their interest in Aadhaar, R.S. Sharma, chairman of the telecom regulatory authority of India, told the Mint newspaper in July 2016. "They’re all keen to see how they can replicate this in their countries," Nilekani said by phone. "This is a great example of how governments can build the most modern digital public infrastructure, and make it available as a public good to everybody."

Quote for the day:

"Nothing is so painful to the human mind as a great and sudden change." -- Mary Shelley

Daily Tech Digest - March 16, 2017

Ethical Hacking: The Most Important Job No One Talks About

Ethical hacking is used to build real-world potential attacks on an application or the organization as a whole, as opposed to the more analytical and risk-based analysis achieved through security audits. As an ethical hacker, the goal is to find as many vulnerabilities as possible, no matter the risk level, and report them back to the organization. Another advantage is that once hackers detect a risk, vendors can add the detection capability to their products, thus enhancing detection quality in the long run. For example, David Sopas, security research team leader for Checkmarx, discovered a potentially malicious hack within a LinkedIn reflected filename download. This hack could have had a number of potential outcomes, including a full-blown hijacking of a victims' computers if they had run the file. It's probably safe to say that just the audit wouldn't have identified this hidden flaw.

Unicef uses data science to track refugees

Unicef is working with Scottish data startup Brainnwave in a collaborative for one of its projects in Somalia, locating and tracking population movement in the country to enable Unicef to allocate resources and efforts to the areas in greatest need. The UK Disasters Emergency Committee is currently putting a spotlight on Somalia and neighbouring countries, and has estimated that 16 million people urgently need food, water and medical treatment. Some 60% of internally displaced people in Somalia are children, said Adler. When the Kenyan government threatened to close the Dadaab refugee camp last year – the biggest in the world, containing some 350,000 people – the need arose to understand where those people would move, to predict where goods and services should be sent.

Artificial Intelligence should not be seen as a threat, it will create more jobs

Human intelligence was still needed in a lot of jobs. It is still needed. But some level of automation in some sectors is bound to happen. “With the progress in technology, now with AI and machine learning, along with IoT, we are getting the ability to play around with more and more data. So definitely there has to be some skill-related training to help people analyse that data. So there will be emphasis on productivity. New jobs will be created eventually, and they will be different from what we have currently,” said Viswanathan. According to Viswanathan, IT companies are leveraging capacity to increase productivity for the customer. He dismisses doomsday talk when it comes to AI and machine learning giving an analogy of how it was predicted many decades ago that automation in the agricultural sector would wipe out the jobs of farmers.

Why hybrid cloud is not just a transitional environment

Hybrid cloud helps you in the same way. You can create amazing new capabilities that leverage the investments you have already made in your backend applications and the data you store. Leveraging cloud services with on-premises backends can add value even when there is no new cloud-native app. A common example is leveraging cloud analytics for new insight to on-premises data. How do you figure out how cloud can drive the most value for your company? For one, you need advisors who have driven success for other businesses. If you look at this purely from a speeds-and-feeds, cost-saving view, you may have missed the immediate value that hybrid cloud can provide. ... A key aspect of driving this innovation is leveraging capabilities instead of building them. Cloud services are one of the fastest methods of driving value more quickly. So where are businesses creating impact?

Security Operations Center (SOC) Is Not New, But More Necessary Than Ever!

By definition, a SOC is an organized and highly skilled team whose mission is to continuously monitor and improve an organization’s security posture while preventing, detecting, analyzing, and responding to cyber security incidents with the aid of both technology and well-defined processes and procedures. The finer points of SOC deployment are very much network and organization-specific, however; following three are major components that every organization must include: People, Process, and Technology. The three exist in all elements of security and should be considered equally critical components while building a SOC. Through people, processes and technology, a SOC is dedicated to detection, investigation, and response of log events triggered through security related correlation logic.

The power of knowledge in the fight against cyber security

Currently, businesses face a real challenge in the search for the cyber security skills they need to succeed. Networkers’ recent Voice of the Workforce research confirmed this lack of skills, with more than half of the 1,656 technology professionals who were surveyed saying they believe there is a skills shortage in the sector they work in. In addition, we found that cyber security is seen as the greatest potential disruptor to the industry over the next five years. Essentially, these findings demonstrate that cyber security will live up to the hype over the coming years, but there aren’t enough people with the level of digital skills needed to deal with its impact. In addition, a 2016 Digital Skills Crisis report by the Science and Technology Committee indicated the full extent of the UK’s lack of digital capability, highlighting that 12.6 million adults lack basic digital skills - a skills gap which costs the economy more than £60 billion a year in lost income.

What Businesses Can Learn From the CIA Data Breach

Among the many CIA exploits that were leaked was one named Weeping Angel, which essentially turns a Samsung smart TV into a silent audio-recording device capable of listening in to conversations even after the device had supposedly been switched off. The exploit garnered attention not because it was particularly sophisticated, but because it demonstrated how trivially easy it is to hack many of the so-called smart "things" that are being connected to the Internet these days. For enterprises, the exploit should serve as a warning of the potential for attackers to increasingly target vulnerabilities in industrial and commercial IoT products in order to then gain entry into the enterprise. Many IoT vulnerabilities stem from Web and Web-based interfaces that are riddled with issues like remote code execution bugs and hardcoded passwords, Kolochenko says.

Is Your Connected Car at Risk? Previous Owners May Still Have Access

The most obvious problem is that, if someone sold the car but was still connected to it, in some cases it would be relatively easy for them to steal it, using the mobile phone as a key fob to unlock and start the vehicle. Many vehicles, however, still require the actual key fob to be present before the car or truck can be driven away. But the fact that prior owners could still be tracking the vehicle’s whereabouts would be enough to give most people pause. In terms of making car buyers aware of the vehicle’s potential connectivity, Hyundai’s Johnson said the automaker also slaps a sticker with an 800 number on its Blue Link–equipped vehicles letting the new owners know it’s equipped and how to get it serviced. These remote services also can cost money—in the case of Blue Link, it’s $198 per year—so most owners call and disconnect when they no longer have the car or truck, Johnson said.

Twitter Counter hacked: Hundreds of high-profile Twitter accounts hijacked

After the Twitter Counter hack, Michael Patterson, CEO of Plixer International said, “Given the political nature of the tweets, it’s not unreasonable to assume this was a state sponsored hack. The message delivered through this hack has received global attention that would likely not have been possible through any other method. This massive exposure becomes an incentive for others to use cyber-attacks as a means of gaining global attention to their cause.” “This highlights the expanded threat surface created when third party applications are granted access to social media platforms and the applications we use every day,” Patterson added. “It is common for consumer applications to request access to social media platforms, and most people will allow that access. Every time you link another application to your social media platforms, you are providing hackers with another possible point of entry.”

Want Good Cyber Insurance? Read The Fine Print

“The major threat to the insurability of cyber is that a systemic attack, such as a cyber attack on the power grid, could cause a catastrophic loss, with many insureds hit by the same event,” Coburn said. With that kind of uncertainty, erring on the side of caution tends to lead to higher prices, more exclusions that limit coverage – or both. “Cyber insurance is a nascent industry,” said Robin Gottschalk, insurance producer on Insureon's technology desk. “So, while complex models are forecasting costs, realized costs can be much different. They can vary widely because there are more incidents than insurance companies are forecasting or because the incidents are more expensive than anticipated.” Steve Durbin, managing director at the Information Security Forum, called risk measurement, “hugely complex,” and said many insurers are still struggling with cyber risks because of a lack of “significant data and trend analysis.”

Quote for the day:

"A man always has two reasons for doing anything: a good reason and the real reason." -- J.P. Morgan

Daily Tech Digest - March 16, 2017

Ransomware: Now cybercriminals are stealing code from each other, say researchers

"We are now seeing that threat actors are starting to devour each other. From our perspective, this is a sign of growing competition between ransomware gangs," says Anton Ivanov, senior security researcher at Kaspersky Lab "Theoretically, this is good, because the more time criminal actors spend on fighting and fooling each other, the less organised they will be, and the less effective their malicious campaigns will be." However, that doesn't mean that you should take their eye of the ball when it comes to protecting against ransomware. "We urge organisations to pay as much attention as possible to the protection of their networks from this kind of threat, because the consequences can be really disastrous," Ivanov added.

Unleash the power of Excel's AutoSum tool

Most users quickly learn how to use Excel's AutoSum to total a row or column of values. For better or worse, some users never move beyond that basic task; they never learn that AutoSum can enter functions for an entire data set with a quick selection and a click, let alone evaluate noncontiguous ranges! In this article, I'll review the basic AutoSum task. Then, I'll show you how to put this feature to work by entering multiple functions with almost no effort. I'm using Excel 2016 on a Windows 10 64-bit system, but most of these techniques will work in earlier versions. You can download the demonstration .xlsx or .xls file or work with your own data. AutoSum is available in 365's browser version, but it's limited because you can't build multiple-range selections.

How to navigate the changing landscape of cybersecurity

The world of cybersecurity has changed drastically over the past couple of decades. We have evolved from a world of keystroke logging and trojans to a universe of full fledged ransomware and cyber warfare. From a governmental, corporate and personal standpoint, the increasing frequency of cyber attacks combined with their severity is unnerving, to say the least. Add to that the fact that the cybersecurity workforce is expected to see a shortage of 1.8 million employees in 2022, and the unsettling feelings are magnified. As malicious threats are becoming more prominent, and perpetrators salivate at the newfound opportunities to make an impact, here are some ways that industry experts are approaching the modern landscape of cyber security

Dealing With Email Security Threats

Although cyber-security issues seemingly become murkier by the day, one thing is very clear: Email is increasingly at the center of enterprise breaches. However, despite perceptions that these attacks mostly originate from the outside, many breaches are connected to internal glitches, breakdowns and problems, according to a February 2017 report from email security vendor Mimecast and Forrester Research. "Email Security Threats: Not Just from the Outside," reveals that there are several noteworthy risks. These include compromised accounts (internal accounts that have been compromised by external attacks), careless misuse (internal policy violators and those who accidentally leak or expose data or systems), and malicious insiders (insiders who purposefully take or misuse data or exploit systems). Not surprisingly, organizations must be prepared for each of these problems, and must use methods and tools to prevent breaches.

An increasingly connected world needs hackers more than ever before

“We believe that cybersecurity is a correctable math problem that, at present, overwhelmingly favors the attackers,” Ryan M Gillis, vice president of cybersecurity strategy for enterprise security company Palo Alto Networks, said at a House Homeland Security Committee meeting last week about protecting the private sector from hacking. “Network defenders are simply losing the economics of the cybersecurity challenge.” One increasingly popular way for a company or government agency to root out vulnerabilities is through a big bounty program, a policy that invites hackers to try to infiltrate its connected networks. Hackers receive financial compensation for identifying entry points that could be exploited for malicious purposes. The idea has been around since at least 1995, when internet browser pioneer Netscape initiated its “bugs bounty” program with a $50,000 budget.

5 tech firms racing to invest in AI startups

Through massive investments in artificial intelligence (AI) startups, the world’s leading tech firms are racing to create markets to transform the economic landscape. According to a report by CB Insights, since 2011 mergers and acquisition activity in the sector has increased sevenfold, with most startups being acquired in the first four years of their initial financing round. In 2016, AI startups drew significant attention, with $1.05 billion pouring in during the third quarter. Here is a look at some of the many tech firms that are investing in AI research in order to capitalize on the shifting digital market.

IT Priorities 2017: Tech leaders remain invested in cloud options

"One of the biggest reasons that we use internal cloud rather than legacy storage systems is that these are all flash arrays," said the respondent from the financial services industry. "Flash arrays allow us better response times, which allow us to deliver better and more responsive service to the business, allowing functionality and analytics that were not possible in the past." Among respondents who said they devoted most of their time to application development, general IT management or other software-related areas, 35% of respondents said they would implement agile development methods in 2017, but cloud application development was close behind, at 31%.

Justice Dept. charges four Russia-backed hackers over Yahoo breach

It's the first time that the US government has charged Russian officials with cyber-related offenses, and said to be part of the largest ever hacking case brought by the US government. Two of those charged, Dmitry Dokuchaev and Igor Sushchin, work for a cyber division known as "Center 18" at Russia's domestic intelligence agency, the FSB, the successor to the KGB. Dokuchaev was arrested in December in Moscow on treason charges, after he was accused of passing state secrets to the CIA. Two other hackers who were also indicted acted with the backing of Moscow, said Justice Dept. and FBI officials in Washington DC. One of those other indicted for-hire hackers, Alexsey Belan, listed as one of the FBI's Cyber Most Wanted criminals, is said to still be in Russia, after he was previously charged with hacking by US authorities on two occasions in recent years.

Why this new school database might be your next data warehouse

It's definitely finer-grained than just saying an order of magnitude boost in operations per second, or something to that effect. Typically, that kind of consideration is just how fast can you write something and then you would read it later. But that type of thinking is old hat and no longer relevant in an era where you want to be analyzing what is happening now, as well as correlating that against what happened in the past, at any given time boundary. So, when we talk about the need to ingest in real time we're introducing a new notion of updateable, fast ingestion. Data warehouses can only append, they cannot update. Since MemSQL can update in real time, that means we can be ingesting lots of data—millions of events per second—and we can still ensure that we are writing and updating and reading all at once.

Load Balancing AWS Auto Scaling Groups With NGINX Plus

With AWS Auto Scaling, you can change the number of EC2 instances in an Auto Scaling group, either manually or automatically, based on schedule or demand. Auto Scaling helps reduce cost by adjusting the number of instances to the right number for the current workload. Additionally, Auto Scaling restarts failed instances, which adds resilience to your applications. Load balancing is crucial when using Auto Scaling. AWS provides load balancing of instances of Auto Scaling groups by integrating its built-in load balancers — Elastic Load Balancer (ELB), now officially called Classic Load Balancer, and Application Load Balancer (ALB) — with Auto Scaling. NGINX Plus provides advanced cloud load balancing for any cloud environment, including AWS, and supports AWS Auto Scaling groups.

Quote for the day:

"When your values are clear to you, making decisions becomes easier." -- Roy E. Disney

Daily Tech Digest - March 14, 2017

The Industrial Revolution of Application Security

Before the industrial revolution, there were several barriers to innovation and advancement. There is certainly a corollary to the current state of application security. The first barrier is the vast landscape of tools and point solutions, which all tend to be vertically focused on specific areas and capabilities. This presents a serious challenge of scaling out both human capital (security engineers) and complete coverage of code repositories and application catalogs effectively. Another barrier is that the security team is typically not integrated into the software development life cycle. This leads to the security team having to be the gatekeeper to application update delivery, or acting as police after the delivery. These two barriers often lead to the creation of a contentious relationship between the DevOps and security operations (SecOps) teams, instead of the collaborative, sharing culture that is inherent to DevOps.

How Blockchain will Change the Future of Financial Service Sector?

Fintech and startup hipsters are already experimenting and successfully cracking the blockchain code, while banks are jumping on the game too as their core business model is continuously being disrupted. We can see collaboration forming between hipsters and suits, where thirty banks, tech giants and other organisations are getting behind Ethereum (a decentralised computing network based on digital currency) forming Enterprise Ethereum Alliance. Big business giants such as Accenture, Banco Santander, BNY Mellon, Intel, JP Morgan, Microsoft, BBVA, BP, Credit Suisse, Fubon Financial, ING, Thomson Reuters, UBS, BNP Paribas, Cisco are uniting to build business-ready versions of the software behind Ethereum.

Strategic IT Infrastructure in 2017

Contrary to popular belief, the public cloud has not swallowed the majority of workloads and applications with only 20 percent of workloads today in the public cloud. And according to IDC, growth is expected to slow after 2017 as businesses begin to pull back from experimentation and optimize storage strategies. Multiple factors will contribute to the slowdown, including concerns over vendor lock-in, security, accessibility and cost. In my view, public and private clouds will co-exist in the long term, and most data centers will be a mix of public cloud and private cloud. While the public cloud can often offer more cost-effective elasticity, experimentation, archival, and disaster recovery, private cloud will excel for more predictable, performance-critical workloads as well as when there are security concerns with using proprietary algorithms or data in the public cloud.

Are there IT jobs in cloud capacity management?

A role is evolving in the IT space for cloud capacity management, wherein an IT professional steers the high-level cloud strategy of the business, said Kurt Marko, technology analyst at MarkoInsights. Another option is to gain skills on a specific public cloud platform for a cloud operations engineer job. Cloud capacity management jobs require an ability to choose cloud consumption strategies and set allocations, then calculate actual use and reconcile the numbers. In contrast, a cloud operations engineer will execute cloud migrations, scale resources up and down, deploy patches and updates and complete related tasks. Businesses refer to these jobs as cloud consumption, procurement or capacity manager positions. Adding cloud capacity planning to the overall IT mission is worth it, especially when companies unknowingly misuse resources. "Cloud makes it very easy for people to spend a lot of money without realizing it," Marko said

Mirai is the hydra of IoT security: too many heads to cut off

Hackers are still modifying the Mirai source code to infect new devices. On Monday, security research group Malware Must Die said it found evidence that Chinese hackers were repurposing Mirai to infect a batch of IoT products, in this case from a Taiwanese vendor. “This could have a huge impact,” the research group said in a direct message over Twitter. “Chinese hackers who used to make DDoS Linux malware are starting to adapt the Mirai source code.” The Chinese hackers appear to have modified the malicious coding to exploit a known vulnerability in products from Avtech, a maker of DVRs and internet cameras. The new strain of Mirai takes advantage of a web scripting bug in the products, triggering them to visit a URL that downloads the hackers’ malware.

Your brain is unique – here’s how it could be used as the ultimate security password

The brain biometric template could even be updated for a different mental activity should there be a security breach on the stored template (unlike a fingerprint biometric which remains for life and cannot be replaced once compromised). Brainprints can also be used to generate passwords that can replace conventional alphanumeric passwords or PINs in ATM machines to withdraw cash. For example, rather than keying in the PIN, one would connect earphones and be shown a series of PIN numbers on the ATM screen. Brain patterns would change when the correct PIN number showed up – activating the transaction. By doing so, one does not have to worry about others looking over the shoulder to steal the PIN. Moreover, under coerced situations, brainprints will not work due to the stress – making them even more fraud resistant.

Continuous Authentication: Why It's Getting Attention & What You Need To Know

A shift to continuous authentication is inevitable, but it’s really in the early days of development, says Mark Diodati, research vice president at Gartner. “The technology is compelling because it solves a lot of security and usability issues,” Diodati says. “Typical authentication today might be a password at the front door to authenticate someone, but over time the security of the session decays.” Whereas confidence of authentication is quite high at the beginning of the process, a variety of events can take place that weaken security, Diodati says. For example, a user might walk away from his desktop computer briefly and someone else takes over the session, or malware infecting the system can take over as well. “The longer the duration of the session the more likely there is to be decay in authentication,” Diodati says.

10 tips for securing microservice architecture

As with every element of technology, there are security risks with microservices as well as best practices for appropriate usage. At face value, it would seem the microservices "molecules within an atom" concept bodes well for security since you might expect application vulnerabilities to be sandboxed off behind virtual walls, so to speak. However, vulnerabilities still can and do exist and even if only one microservice can be compromised - the account access microservice in the ecommerce application example - that still represents a risk. After all, if burglars can only break into one room of your house and manage to infiltrate the living room, your flat screen television still ends up on eBay. In addition, the plethora of diverse microservices can also increase complexity and make security harder to achieve, especially if different developers and methods are in use across the application.

Revolutionising the cyber-security skills gap with ‘ethical hacking’

Another business-oriented method of closing the skills gap is for organisations to make the path to employment within the security space a far more enticing one. Incentivised programmes will go a long way towards creating awareness and inspiring students, and in guiding them in selecting courses and graduate programmes which are relevant and useful. Ultimately, for students to engage with the practical realities of cyber security, company graduate programmes, internships and bursaries are vital. Organisations can use this investment to ensure students study the right subjects, gain the right insights and make the right choices to enter this area of work. This level of investment into upcoming talent ensures long-term development of the skills pool, going a long way towards mitigating the current crisis.

AMD busts Ryzen performance myths, clearing Windows 10 from blame

“Based on our findings, AMD believes that the Windows 10 thread scheduler is operating properly for ‘Zen,’ and we do not presently believe there is an issue with the scheduler adversely utilizing the logical and physical configurations of the architecture.” Why this matters: Ryzen’s confusing benchmarks have fueled this hot debate. In many multi-threaded tasks, it performs like a bat out of hell and easily matches Intel CPUs that cost twice as much. But when it comes to gaming at standard resolutions of 1080p or at low-quality settings, the performance can lag behind Intel’s newest 7th-gen Kaby Lake CPU, as well as its Broadwell-E chip. Our own tests have shown that at higher resolutions and and higher game settings, the average gamer is unlikely to ever see the difference. And yet the debate rages on.

Quote for the day:

"A coach is someone who can give correction without causing resentment." -- John Wooden

Daily Tech Digest - March 13, 2017

8 Public Cloud Security Threats to Enterprises in 2017

Cloud uptake will accelerate faster in 2017, according to a report by Forrester. ‘Enterprises with big budgets, data centres, and complex applications are now looking at cloud as a viable place to run core business applications’ says Dave Bartoletti, analyst at Forrester. An average of 1031 cloud services is now in use per enterprise — up from 977 in the previous quarter — according to Netskope’s January Cloud Report. But the threat of cyber crime in 2017 is massive and data breaches are becoming more commonplace. With the average cost of a breach now a massive $4 million, enterprises cannot afford to consider public cloud cyber security an afterthought. But there are numerous cyber security threats out there for enterprises migrating to, or already running critical infrastructure in the cloud.

Getting started with Perl on the Raspberry Pi

The origin of the myth is simple. The Raspberry Pi's creator, UK Computer Science professor Eben Upton, has told the story that the "Pi" part of the name was intended to sound like Python because he likes the language. He chose it as his emphasis for kids to learn coding. But he and his team made a general-purpose computer. The open source software on the Raspberry Pi places no restrictions on us. We're all free to pick what we want to run and make each Raspberry Pi our own. ... 'PiFlash' script was written in Perl, but it doesn't require any knowledge of Perl to automate your task of flashing SD cards for a Raspberry Pi from a Linux system. It provides safety for beginners, so they won't accidentally erase a hard drive while trying to flash an SD card. It offers automation and convenience for power users, which includes me and is why I wrote it.

Millennials vs Fintech

Ask 10 Millennials about the definition of Fintech, and only one will answer you correctly (if you’re lucky). But don’t let that fool you, or think that as a bank or company, you shouldn’t invest in financial technology for your clients. Because nine out of these ten Millennials is using financial technology on a daily basis. Life has become phygital, which means that - for youngsters as for the rest of us - the boundaries between digital and fysical are fading. For instance, we use our banking app to transfer money to friends and colleagues instantly, but we go see our banker face-to-face (in the bank/video call) for troubleshooting a financial affair. This trend is unlikely to go away. Technology will continue to infuse our daily lives, be it less and less intrusive and visible. But the technology is no goal in itself. People don’t want tech, they want convenient, instant and transparent services. Technology is only the means to an end.

Now Google's clever AI can tell you're not a bot without reCAPTCHA even appearing

Google hasn't explained how the system works, and as Ars Technica notes, that's probably because Google doesn't want to help spammers bypass it. However, the reCAPTCHA API that supports the ReCAPTCHA checkbox is still working in the background. It allows Google to collect and analyze information about devices and apps. Google has previously said it uses "advanced risk-analysis techniques to distinguish humans from machines". The company's backend services connected with the reCAPTCHA API assess a visitor's interaction with the CAPTCHA before, during and after to tell if they're bots. The evolution of the technology has allowed it over time to introduce easier puzzles for low risk profile visitors, and harder ones for probable bots.

Why C-Levels Need To Think Differently About Social Media Strategy

“Consumers now know that when it comes to customer service, social media gives them much more power,” says Erik Huberman, CEO of Hawke Media, a top outsourced CMO partner. “With social media, these consumers are acutely aware that if they have a problem with your company and you don’t handle it well, they hold the power to expose the issue to their entire network, which can be devastating to a company.” ... It should probably go without saying, but today’s consumers expect timely responses. 32% of consumers who reach out to a brand on social for customer support expect a response in 30 minutes, and 42% expect a response within an hour. For brands without robust social teams, that kind of response time might sound ambitious at best. But with all the tools and technology we have available today, there’s no real excuse for delayed responses anymore — at least in the consumer’s eyes.

Open source security and ‘hacking robots before skynet’

How about robots with wheels instead of legs? Researchers have also proven that cars can be hacked, including steering, brakes, and the infotainment system. Uconnect, an Internet-connected computer feature in hundreds of thousands of vehicles, controls the entertainment and navigation systems, enables phone calls, and even offers a Wi-Fi hot spot. Thanks to one vulnerable element, using the vehicle’s Uconnect system, which plugs into a cellular network, security researchers were able to gain control of the car’s entertainment system and then rewrite the firmware to send commands to critical systems like the brakes, steering, and transmission. In a world where self-driving cars are already on the roads, this should worry everyone. Cars are among the most sophisticated machines on the planet, containing 100 million or more lines of code.

Disaster recovery: How is your business set up to survive an outage?

“The problem is the cost of maintaining and running these infrastructures. If an application or service has requirements to truly be a 'dial tone-like' system (always on – never without) then a business will spend the dollars required to ensure the five nines of availability and then some,” he said. ... Clustering has also been around for a long time for servers and as that technology has moved down the stack into the infrastructure services, the ease at which availability can be provided is greatly improved – just at a cost. Although he said cost is not the only down side. “Active-active recovery solutions do not account for user error. They are garbage in garbage out, and in the event of this type of an outage, you need to have something that is tracking point in time consistency of the data to recover back to. The GitLab outage from a few weeks ago is a great example of this,” Foster said.

PwC and Startupbootcamp chart fintech maturity

The early perception of FinTech is shifting. Where startups were once seen as a threat by incumbents, the emphasis is shifting to one of collaboration. While it has taken a while for startups and incumbents to find a way to work together, Startupbootcamp and PwC have witnessed a clear increase in the two parties working together to solve important problems - both for customers and for the companies themselves. As the relationship matures, incumbent financial services firms continue to struggle with measuring and reporting the success they find when partnering with startups. Nevertheless, the atmosphere of collaboration and mutual understanding is positive and expected to accelerate.

Mainframe: platform of choice for machine learning and ops intel

CA is making significant investments in the areas of machine learning, advanced analytics and automation to drive towards more intelligent mainframe management, addressing not only Mean Time to Resolution (MTTR) but more importantly, “Predicted Time to Avoidance” (PTTA). This represents a shift into a category that Gartner calls AIOps. “AIOps platforms represent the evolving and expanded use of technologies previously categorized as IT operations analytics (ITOA). This shift is in response to the growing importance (due to digital business demands) and the use of big data and machine-learning technologies across all major ITOM functions, including the service desk, automation and monitoring.” At CA, we believe that MTTR is just part of the solution because it only alerts the mainframe system operator of an issue after it has happened – reactive problem solving.

Bittercoin: true blockchain believers vs. the trough of disillusionment

Is this a slow death spiral, signalling the sad end of Satoshi Nakamoto’s dream and the motley crew of plucky cryptoheroes who defend it? Or is something interesting happening beneath this sheen of despair and decay? The answer is: possibly neither, probably the latter, almost certainly not the former. The searching-for-the-new-new-thing, what-have-you-done-for-me-lately mindset of so much of the tech industry tends to equate a period of slow grinding with stagnation and death. This is not so. The quixotic quest for the cryptocurrency “killer app” — one that will bring widespread, mainstream usage — continues, and won’t succeed any time soon; but, meanwhile, a whole panoply of interesting and practical use cases has arisen. Call them “maimer apps.”

Quote for the day:

"Inspiration is a guest that does not willingly visit the lazy." -- Tchaikovsky

Daily Tech Digest - March 12, 2017

The new European data protection regulation– are you prepared?

The impact of the new regulation on organizations will be manifold and no business will remain unaffected, especially in the light of the ongoing digitalization. Organizations have to understand which of the information they are keeping are impacted by the regulation and how it is handled today, where and why it is kept and how it is protected. It requires understanding and adaption of business rules, business processes, information systems and IT infrastructure. Sounds like a complex and pretty big task to get on top of, and, bad news first, it is for sure not something that is done overnight. But the good news is that now is a good time for getting prepared, and that both methods and tools exist for getting a good grip on the job. Organizations that already have control over the enterprise’s architecture get a head start when it comes to understanding how they should react to changing market dynamics.

AI won’t kill you, but ignoring it might kill your business, experts say

"Amplifying human intelligence, and overcoming human cognitive biases – I think that's where it fits," said Pratt, founder and CEO of business consultancy Noodle.ai. "Humans are really bad probabilistic thinkers and statisticians. That's where cognitive bias creeps in and, therefore, inefficiencies and lost profit." But machines won't replace humans when it comes to big-picture decisions, he said. "Those algorithms are not going to set the strategy for the company. ... It'll help you make the decision once I come up with the idea," Pratt said. "But any executive that doesn't have a supercomputer in the mix now on their side – and they're stuck in the spreadsheet era – your jobs are going to be in jeopardy in a few years."

RawPOS Malware Rides Again

As part of a recent forensics investigation by the Cylance Consulting Services team, we uncovered some new RawPOS malware. This family of POS malware has been widely documented in operation since 2008. Numerous retail operations of various sizes have been compromised with this malware and its variants. Rather than rehash old malware, our intent is to discuss ‘signature fidelity’ and explain through technical detail why poorly-written signatures give people a false sense of security. This ‘antivirus is dead’ argument is often presented, but with little technical detail to highlight specifically why this is the case. ... At the end of this post, we’ll provide an updated yara file for identifying all variants of the RawPOS dumper, as well as some sha256 hashes of the new variant.

Digital Transformation Telco Playbook Overview

To thrive in a highly competitive landscape, service providers need to fundamentally rethink their culture. Many of those companies were born as monopolies, and although they have evolved, they are behind webscalers and other innovative companies. Therefore, a fundamental change in their culture is an essential ingredient for their longterm competitiveness: Create an environment where innovation and creativity are encouraged and supported rather than subjected to the frameworks of the existing business; Evolve the business support environment and operations to support a more pioneering and agile environment; Create incentives to reward innovation. Tolerate failure as an opportunity to learn and improve; Create the appropriate financial strategy and metrics that will support innovation, as well as an elastic infrastructure and agile go to market strategy; and Establish the appropriate incentives and rewards for innovation.

How to find the real value in operational big data

Operational Intelligence represents breadth of knowledge—an important and challenging milestone in a company's analytic maturity. If you have 1,000 sites around the world and each site collects, processes, and analyzes its own operational data, then the most any one site can know is what's within its own walls. This is a common situation, as there is typically one site manager who manages data in a way that best helps him or her accomplish the plant's performance goals. Consolidating and standardizing site data broadens the company's information base for the benefit of all. With a centrally organized OI system, site managers can garner insights into how other sites are doing; it opens channels for data-based performance ranking, continual learning from best practices, and accurate benchmarking.

5 Industry Experts on How Technology Will Affect the Future of Recruitment

“It’s about the right mix of technology and in-real-life, human-to-human experiences. It’s important to have regular, reliable, repeatable patterns and good data in your recruiting processes to ensure that candidates are all treated the same way. That said, you can’t use technology to do the work that humans do. It’s got to be the right blend of technology and human interaction. One of the lessons for recruiters is that you can’t Skype your way to an effective hiring decision. You have to bring candidates in and spend some time with them.” ... While technology is playing an important role, personal relationships – the ability to find that visceral connection between your company and the person you’re talking to – is the linchpin.

FBI Chief Calls For Private Sector To Help Battle Cybercrime

"If you are the chief information security officer [CISO] of a private enterprise, and you don't know someone at every single FBI office where you have a significant facility, you're not doing your job. Know that you're pushing on an open door," Comey said. "We're not looking to know your private information, but we need to know you in a way so we can help you in a difficult circumstance." Comey described a multi-pronged initiative underway at the FBI to crack down on cybercrimes that involves recruiting and hiring more cyber experts, improving engagement with outside partners -- including the private sector -- and rethinking the bureau's traditional approach to working cases. The bureaus is also working to bolster deterrence both through hardening systems that might be targeted and winning convictions in more criminal cases.

FinTech Is Not Dying; It Is Evolving

The juggernauts of online lending soon became like the banks themselves. Internally, they regulate themselves to keep shareholders happy. They know they need to pivot and evolve as the industry matures but they still hold to what made them a success in the first place. Unfortunately for our industry pioneers, companies that are slow to evolve in an industry that was built on speed and revolution is not swift or flexible enough to keep up with the changing atmosphere. There are those who study and analyze the good and the bad of these online lenders. While the big companies try to evolve and stay relevant, second generation companies pop up wanting a piece of the market. They tackle the biggest user issues and fix them. FinTech, as we knew it under the first regime, is dying. Evolution has changed online lending.

How Artificial Intelligence Will Invade Classrooms

Educational technology has really struggled. Many incredibly insightful projects that were developed and proven in labs have not succeeded, including AI-powered cognitive tutors that actually understand the mistakes [students] are making and can offer direct supervision. It turns out the wrong way of [integrating AI] is sitting a bunch of kids in front of a computer for hours, marginalizing the teachers. Education is probably ground zero for how the best-intentioned technologies can still really struggle to make a difference. In fact, research indicates that most educational technology actually makes inequality worse, rather than better. Ming: We don’t want just a plug-in education. A lot of edtech uses words like personalization, but the truth is that it does plug every student into a mold, and you just follow a track

Reusing Selenium Scripts in Random Testing

The entire test execution process using a subjective technique is guided by a great deal of solid analytical thinking and a good portion of “randomizm”. With the latter one being a key ingredient, this article is dealing with automation of the yet-unveiled “randomizm”. To make things clear, test automation is not creativity; it’s a well-documented and a clearly defined approach which enables the same test scripts to run over and over again. The question is, how can we leverage those test automation scripts and be more creative at the same time? A product quality model with the documented test scenarios can be outlined with a specific state machine with external attributes. And that’s what test automation loves. Test automation is all about writing test scripts based on a very specific set of test requirements.

Quote for the day:

"Until you cross the bridge of your insecurities, you can't begin to explore your possibilities." -- Tim Fargo

Daily Tech Digest - March 11, 2017

Demystifying Advanced Data Visualization

Advanced Data Visualization gives a new meaning on how pictures can simplify information needed to comprehend complex questions. Angela Hausman states that Big Data does not mean much if the people who control change can’t understand or have to spend too much time deciphering the Great Data that is presented. In addition, Big Data speeds across the Internet, captured from people and the Internet of Things (IoT) including items such as appliances, GPS, and building maintenance. This Big Data constantly updates, second by second, providing not a static picture, but a dynamic movie. Organizations, need to find ways in keeping up with this Big Data in order to understand their customers better and to move much more quickly, smoothly, and efficiently.

Four perspectives on data lakes

Governance is a practice that you apply to “something.” Just like James Watt’s fly-ball governor for the steam engine, a governance program seeks to keep a engine in balance so it works effectively. This engine may be a process, organization, or flow of information. The important point is that the target of what you are governing is clearly defined. Approaches to governance, particularly around a data lake, vary widely due to the different choices that organizations make in their definition of the engine being managed. For example, the IT department may see the data lake engine as a collection of technology working together. The business may see the data lake as part of an innovation engine helping them to create new value from data. So which is the right engine to govern? It depends on the objective for data lake.

AWS Outage and High Availability

Your HA strategy should be also tied to your monitoring, alerting, remediation but also to your customer support strategy. Monitoring and alerting is clear – you want to know if your site or parts of it are down and take the appropriate actions as described in your remediation plan. But why, your customer support strategy? Well, if you haven’t noticed – AWS Service Dashboard was also down yesterday. The question comes up, how do you notify your customers of issues with your service if your standard channel is also down? I know that a lot of IT guys don’t think of it but Twitter turns out to be a pretty good communication tool – maybe you should think of it next time your site is down. Developing solid HA strategy doesn’t need to be a big bang approach.

Quantum technology is beginning to come into its own

Everything in the natural world can be described by quantum mechanics. Born a century ago, this theory is the rule book for what happens at atomic scales, providing explanations for everything from the layout of the periodic table to the zoo of particles spraying out of atom-smashers. It has guided the development of everyday technologies from lasers to MRI machines and put a solid foundation under astrophysicists’ musings about unknowables such as the interiors of black holes and the dawn of the universe. Revealed by a few surprising discoveries, such as that atoms absorb and emit energy only in packets of discrete sizes (quanta), and that light and matter can act as both waves and particles, it is modern physics’ greatest triumph.

Protecting the enterprise against mobile threats

As it is with securing the traditional network, mobile security is also about building policies. "Security resources are scarce," said Simkin, "so, organization needs to think about how they safely enable those mobile devices to access corporate resources. They need to take the time now to consider what technology they are going to put into place to keep the company safe." Even the White House is changing the paradigm a little bit. The President's now infamous use of an Android phone has helped bring to light the need for better mobile security, said Paul Innella, CEO at TDI. "If organizations don't start treating mobile devices, which includes IoT, as corporate assets, they are going to see this wide scale disruption and infiltration. So, they have to be thinking about how they evaluate the risk of one of these mobile devices coming into their environment," Innella said.

Google offers new 'Always Free' cloud tier to attract users

The free offerings are meant to help attract users to Google Cloud Platform at a time when the company is competing against Amazon Web Services, Microsoft Azure and other public cloud providers for developers’ time and attention. Google’s Always Free tier is somewhat similar to what AWS offers its customers. For example, both platforms allow users to run workloads using their respective event-driven compute services, AWS Lambda and Google Functions. One thing that sets Google apart is its willingness to hand out a free virtual machine. Google previously offered a 60-day free trial with $300 in credits. An extended trial was one of the cloud provider’s most-requested features, since the short time limit often wasn’t enough for a full proof-of-concept test.

Pablo Brenner talks reverse psychology in IT collaboration

The aim is to use automation to help create an environment similar to Stack Overflow inside a company. This could be as simple as offering pop ups on a library telling individuals to avoid this particular site (“programmers spend a lot of time using the wrong library”) and also help to attach skills to a developer. “We’re building life CVs on people,” says Brenner. This may seem a little worryingly intrusive, but Brenner doesn’t think so. He stresses that the system is only looking at technology skills not what people are generally reading online at work. “Like any tool, it could be used in a bad way,” he concedes, but he does not feel there should be any concern that employees will be categorised within an organisation based on the number of skills they have because this is too hard to define. Some people have broader knowledge some people have deeper knowledge.

Banking Industry Still Taking Small Steps with Big Data

Financial organizations also must use data and advanced analytics for fraud and risk mitigation and achieving regulatory and compliance objectives. With cybersecurity more important than ever, falling behind in the use of data for security purposes is not an option. While the majority of institutions might have much of the infrastructure in place to manage the increasing flow of data, significantly fewer have their data integrated across silos. This continues to be a challenge as customer expect their financial organization to understand their entire relationship when working with their bank or credit union. This challenge is obviously exacerbated with smaller organizations who may not even have a CRM system in place.

Facebook rolls out Bryce Canyon, its next-gen storage platform

Facebook on Wednesday unveiled a new storage platform, Bryce Canyon, that offers the efficiency and performance necessary to support the social media company's "video first" strategy. The design specification for the platform is available via the Open Compute Project. It'll be used primarily for high-density storage, including videos and photos. Bryce Canyon supports 72 hard disk drives (HDDs) in four Open Rack units. That's a 20-percent higher density than Open Vault, the first storage enclosure that Facebook in 2013 contributed to the Open Compute Project. Bryce Canyon is also Facebook's first major storage chassis designed from the ground up since Open Vault. Meanwhile, Bryce Canyon also offers a 4x increase in compute capability over the Honey Badger storage server designed in 2015.

Troubleshooting Memory Issues in Java Applications

For a Java process, there are several memory pools or spaces - Java heap, Metaspace, PermGen (in versions prior to Java 8) and native heap. Each of these memory pools might encounter its own set of memory problems, for example– abnormal memory growth, slowness in the application or memory leaks, all of which can eventually manifest in the form of an OutOfMemoryError for these spaces. In this article we will try to understand what these OutOfMemoryError error messages mean, which diagnostic data we should collect to diagnose and troubleshoot these issues, and will investigate some tooling to collect that data and analyze it for resolving these memory problems. This article focuses on how these memory issues can be handled and prevented in the production environments. The OutOfMemoryError message reported by the Java HotSpot VM gives a clear indication as to which memory space is depleting.

Quote for the day:

"It is a leader's job to challenge the status quo. And when you do, you make enemies." -- @CarlyFiorina

Daily Tech Digest - March 10, 2017

Application support and maintenance add up to operational ALM

Approach operational maintenance and support lifecycles with a concept of application states. Every application exists in a specific number of states, each representing a set of components and workflow relationships. One state is usually considered the normal or base state, and all the others are responses to special conditions. In this multi-state dynamic, application maintenance and support has two goals throughout the application's lifecycle. It must define each possible operating state precisely, in terms of component hosting and workflow connection through the network. It also must manage the application's dynamic movement from one valid operating state to another, exhibiting stable, secure and compliant behavior.

Approaching Cybersecurity Risk Management At Any Organization

First, get the company leadership on board. A cyber risk management strategy is unlikely to succeed if it is not a priority across the entire organization. Second, outline and implement a strategy for securely adding new technologies – whether it is a new finance application or connecting something to the network. Review the new solution versus the rest of the network and determine if it adds or eliminates any risk, and assess if its level of impact is acceptable. Finally, educate your employees on their role in the overall corporate cyber risk strategy. Employees could be viewed as an easy target for criminals, so consistently educating them on the threats facing the organization will help prevent some attacks.

Bots: Biggest Player On The Cybercrime Block

Joe St. Sauver, scientist at Farsight Security, said bot makers, using compromised devices, spread the “traffic” among multiple IP addresses, “so that some clicks come from Oregon, others come from Ohio, others from Oklahoma etc. “That software may also include routines designed to mimic natural pauses, while pages are ‘being read,’ or subsequent clicks – perhaps drilling down on optional features, looking for local dealers or other things that look like what a normal human visitor would do,” he said. But Tiffany said too many security professionals still, “falsely assume that bot traffic looks robotic.” Instead, it comes from residential IP addresses, uses real browsers and does unrobotic things like, “run JavaScript, run Flash, use the victim's cookies to look like real humans, and interact with pages like real people, often by emulating the real people who own the computers they've infected.”

China mulls national cryptocurrency in race to digital money

It’s not surprising that countries have found it difficult to tackle cryptocurrencies. People exchanging things on peer to peer (P2P) networks used to be the music and video industry’s problem. Now, suddenly, people were exchanging money with them. When used properly, P2P money offers true anonymity, which creates problems for authorities trying to track the flow of cash to terrorists and organized criminals. Left unchecked, it’s also a great tax evasion tool. Where governments are regulating, they’re typically making sure that anyone trading bitcoins registers their identities so that authorities can follow the money. It’s a tricky line for policymakers to walk. Governments need to control cryptocurrencies, but if they squash them altogether, they risk missing some of its best innovations.

Deep packet inspection: The smart person's guide

Although DPI has a number of uses, the practice is rooted in enterprise network security. Sniffing traffic in and out of a network is understandably useful for preventing and detecting intrusions. Detecting and blocking the IP of malicious traffic is particularly effective at fending off buffer overflow and DDoS attacks. DPI is also used by internet service providers. If packets are mail, ISPs are the postal service and have access to unencrypted web traffic as well as packet metadata like headers. This provides ISPs with an abundance of useful information, and the companies leverage access to user data in a number of ways. Most ISPs in the United States are allowed to turn user data over to law enforcement agencies. Additionally, many ISPs use consumer data to target advertising, analyze file sharing habits, and tier access service and speeds.

State of Cyber Security 2017

State of Cyber Security 2017 reports the results of the annual ISACA global cyber security survey, conducted in October 2016. The survey results bolster the belief that the field of cyber security remains dynamic and turbulent during its formative years. Weekly news headlines confirm that cyberattacks are not a seasonal threat or dependent on specific industry environmental attributes, but are constant and should remain forefront in every enterprise executive’s thought process. To equip you with a comprehensive understanding of the cyber security industry through the lens of those who define it—the managers and practitioners—ISACA is presenting the survey results in a series of reports that focus on individual topics. This report is the first in the ISACA State of Cyber Security 2017 white paper series and presents timely information about cyber security workforce development and its current trends.

Big Growth in Data Security Provides Consultant Opportunities

Consultants need superior application and network penetration skills. This means that they should be able to break down, and analyze the way that software works within any environment. This includes input and output channels. Networks need to be understood in the same way. The purpose of this knowledge, is to identify where risks exist, or where existing security breaches are occurring. Software algorithms are known to provide false positives, so a consultant needs to be able to identify these, and should have skill in determining viable threats. This will help the consultant to allocate resources where they are most necessary, which can benefit their employer, financially. Consultants should build an understanding of the technologies used by their employer. Whenever working on a contract, a consultant will deal with systems that they are unfamiliar with.

Data Security: Don’t Call an Ambulance for a Sore Throat

It’s a constant struggle, one that today’s businesses fight with infrastructure- and device-based approaches, and (vital but often neglected) employee training against social engineering attacks. The challenges continue as technologies evolve from “strange new risk” to “vital to business success.” Five or six years ago, security concerns led many businesses to declare they’d never use cloud services. You’d be hard-pressed to find a CIO or CEO who’d say that today. Just as businesses have evolved toward the cloud, they’re also evolving toward enterprise-wide data access. We recognize the valuable insights and innovations to be gleaned from trading siloed departmental data warehouses for the comprehensive enterprise data lake. Tearing down those silos can cost us a layer of security around specific data sets, but curling up in an information panic room is not the way forward.

Application layer security puts up another obstacle for hackers

Businesses are baking security into applications during the development process. "Identifying a security flaw in development is much less expensive than doing it once the application is running," stated Nathan Wenzler, chief security strategist at AsTech Consulting, a cyber-risk management firm in San Francisco. ... In static analysis, security software examines code without running it. It analyzes source code, identifies locations where vulnerabilities may exist and outlines potential fixes. Dynamic analysis is another option wherein the IT team tests and evaluates application security while compiling the software. Dynamic analysis tools pepper the application with attack scenarios to detect vulnerabilities.

CIA-Made Malware ? Now Antivirus Vendors Can Find Out

Among those techniques are ways to bypass antivirus software from vendors including Avira, Bitdefender and Comodo, according to some of the leaked documents. The documents even include some snippets of code that antivirus vendors can use to detect whether a hacking attempt may have come from the CIA, said Jake Williams, founder of security company Rendition InfoSec. “In the documents, they (the CIA) mention specific code snippets used in operational tools,” Williams said. Antivirus vendors can use this to look at their customers’ networks for any traces of past intrusions. That might be a big blow to the CIA’s surveillance operations. Now anyone, including foreign governments, can use the WikiLeaks dump to figure out if the CIA ever targeted them, according to Williams.

Quote for the day:

"If people follow you, you have an obligation not to abuse that trust." -- Gordon Tredgold